Overview

overview

10

Static

static

3

JaffaCakes...74.exe

windows7-x64

10

JaffaCakes...74.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8abbe404ee7b050a3bacb7313d9c7c74

  • Size

    197KB

  • Sample

    250117-ny5b8awrcr

  • MD5

    8abbe404ee7b050a3bacb7313d9c7c74

  • SHA1

    b741145093b4ec95794128e56be97b649bc0d6af

  • SHA256

    a96decac88c50c9186d5ad3a83533c9315a2956fde0ef15a3f78445aceb751a3

  • SHA512

    b4f4f76b8eeba05dc7b665744a62560fd8961b847f6213c0ce8584a8163b5d0b70f20fd169ab1adff4295907da5bc12d5624348f6f8c2adca13e0b13d6b15a22

  • SSDEEP

    3072:4YsmqTAj1irjQYX5NUvRixHMRv7EGU/PqzcOHsfK96HfBuX0QF:4Ysxsj1iHNX5S4xHqlg0T5G

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://2.cafeexcelente.com/forum/viewtopic.php

http://2.chocoramo.com/forum/viewtopic.php
Attributes
  • payload_url

    http://estilianaragdolls.de/Si7ySG.exe

    http://kuntticaret.com/v6e7WMJ.exe

    http://www.gamarubber.com/NPY.exe

    http://www.10130138.wavelearn.de/4pxp.exe

    http://hotnewinfo.info/8fhr0.exe

    http://saltasalta.cl/8Mo.exe

    http://184.107.222.147/c6uHT1.exe

    http://penguinplanning.com/CX1.exe

    http://makitayedekparca.info/nW8KcF.exe

    http://plusloinart.be/Ue7cHNm.exe

    http://flbuysellrent.com/x9d.exe

    http://marengoit.pl/ZBrBpBh2.exe

Targets

    • Target

      JaffaCakes118_8abbe404ee7b050a3bacb7313d9c7c74

    • Size

      197KB

    • MD5

      8abbe404ee7b050a3bacb7313d9c7c74

    • SHA1

      b741145093b4ec95794128e56be97b649bc0d6af

    • SHA256

      a96decac88c50c9186d5ad3a83533c9315a2956fde0ef15a3f78445aceb751a3

    • SHA512

      b4f4f76b8eeba05dc7b665744a62560fd8961b847f6213c0ce8584a8163b5d0b70f20fd169ab1adff4295907da5bc12d5624348f6f8c2adca13e0b13d6b15a22

    • SSDEEP

      3072:4YsmqTAj1irjQYX5NUvRixHMRv7EGU/PqzcOHsfK96HfBuX0QF:4Ysxsj1iHNX5S4xHqlg0T5G

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks